Thread by @gabrielazanfir

⚡️Breaking news from the EU & #GDPR land: the Italian Data Protection Authority #GarantePrivacy issued an order today against OpenAI, effectively blocking #ChatGPT in Italy (ordering it not to use personal data of Italians). Here is a deep dive into the short order - 1/

What did the Italian DPA #GarantePrivacy found problematic with ChatGPT4?
- Lack of transparency
- Absence of a lawful ground for processing
- Not respecting accuracy
- Lack of age verification
- Overall breach of Data Protection by Design
Why for each? A short explainer:
2/

A) Lack of transparency

Pursuant verification, the #GarantePrivacy found that no information is provided to users of the service, nor generally to people whose data have been collected by OpenAI & processed through the ChatGPT service.
=> a breach of Art. 13 #GDPR
3/

So what does this mean?
It means that the Garante was looking to see whether OpenAI informed users and people whose personal data are processed through #ChatGPT4 about what personal data they process, for what purpose, on what legal basis, do they transfer it outside the EU? 4/

This level of transparency is required by the #GDPR. If the data is not collected directly from users, the sources of where the data comes from must be disclosed in a data protection notice. The Garante found there was no transparency for Italian users in this sense. 5/

B) Absence of a lawful ground for processing

No appropriate legal basis was identified for "the collection of personal data and their processing *for the purpose of training the algorithms underlying the operation of ChatGPT*"
=> a breach of Art 6 GDPR 6/🧵

This means that the Garante looked into whether OpenAI asked the consent of people whose personal data it used to train the algorithms behind #ChatGPT, or if they used Legitimate Interests, or maybe contract - otherwise processing the data would be illegal per Art 6 #GDPR 7/🧵

C) Not respecting the principle of accuracy

#GarantePrivacy noted that the processing of personal data does not respect the accuracy principle, as the information provided by #ChatGPT does not always correspond to accurate personal data
=> breach of Art 5 GDPR 8/🧵

Now this is fascinating and it goes back to one of the core issues that Data Protection law was created from its beginning in the '70s to tackle: keeping computerized personal files of people accurate and up to date.
Did you notice half-true bios of people from #ChatGPT? 9/🧵

Well, the #GDPR has a principle of accuracy which mandates that personal data must be accurate & kept up to date + every reasonable step must be taken to ensure that inaccurate data, are erased or rectified without delay.
Pretty big deal I would say. 10/🧵

D) Lack of age verification

Finally, the #Garante also took issue w "the absence of any verification of the age of users in relation to the ChatGPT which, according to the terms published by OpenAI, is reserved for subjects who are at least 13 years old" 11/🧵

#GarantePrivacy further noted that "the absence of filters for children under the age of 13 exposes them to absolutely unsuitable answers with respect to the degree of development and self-awareness".
Garante refers to a breach of Art 8 #GDPR 12/🧵

There is no age verification mandate per se in the #GDPR. However, it provides in Art 8 that parental consent is required for children who use IT services where consent is the lawful ground.
This might suggest Garante thinks consent is the legal basis for using data by #LLMs 13/

Very interestingly, when quoting all the articles that the #Garante suspects have been breached, Art 25 GDPR - Data Protection by Design and by Default - is enumerated. There is no explanation as to why, but one who knows that provision can deduct why. 14/🧵

What this technically means is that complying with all these requirements should have been embedded in the service from the outset, from when it was buying built, as opposed to being an afterthought.
What now? What does the order for a ban actually say?
15/🧵

Well, #GarantePrivacy is using specific powers that have been granted to *all DPAs* under the #GDPR, in Art 58(2)(f) "to impose a temporary or definitive limitation including a ban on processing".
This is a temporary ban. OpenAI has 20 days to respond to these concerns. 16/🧵

An interesting consideration here: As noted in the Order, #OpenAI doesn't have a main establishment in the EU, but it has a representative for #GDPR purposes. This means that it can't enjoy One Stop Shop mechanism, leaving it exposed to ALL EU Data Protection Authorities 17/🧵

Last but not least - this is a wake up call that #GDPR, #Article8 Charter, data protection law in general & particularly in the EU IS APPLICABLE TO AI SYSTEMS today, right now, and it has important guardrails in place, if they are understood & applied. 18/🧵

Link to the Order: garanteprivacy.it/web/guest/home…
Link to a podcast where I explain what Data Protection law is & how it differs from Privacy: open.spotify.com/episode/72MAFJ…
Link to #GDPR Case-Law on algorithms & ADM digested for you: fpf.org/wp-content/upl… END of 🧵